CVE-2026-75816

Frontend Admin by DynamiApps, a WordPress plugin for building frontend forms and user-profile editing, contains an authentication-bypass flaw that enables unauthenticated account takeover (CVE-2026-75816). The pre_update_value function performs no capability or ownership check, and ActionPost::conditions_logic() skips its current_user_can('edit_post') authorization gate whenever the post ID is non-numeric (e.g., the string user_1), so unauthenticated form submissions can be routed to arbitrary user records without restriction. An attacker can therefore overwrite any user's registered email address, including an administrator's, and then leverage WordPress's native password-reset flow to fully take over the targeted account. Any WordPress site running the plugin in versions up to and including 3.29.12 is affected. No public proof of concept is known and the issue is not in CISA's KEV; EPSS currently estimates a roughly 0.5% probability of exploitation within 30 days.

What to do: Update Frontend Admin to a patched release newer than 3.29.12 as soon as one is available. Until patched, temporarily deactivate the plugin or restrict its public form submissions, then verify that no administrator (or other) accounts had their email address changed unexpectedly and review for unrecognized password resets. Monitor for public exploits, as a critical 9.8-rated flaw like this can draw rapid attack activity once a PoC appears.